Adaptive software configuration for a medical device

ABSTRACT

This document describes, among other things, a method of operating a medical device comprising updating a regulatory approval status stored in at least one of the medical device or a second device operable to communicate with the medical device, and enabling or disabling the at least one function in the medical device based on the regulatory approval status. The regulatory approval status corresponds to at least one function performable by the medical device.

RELATED APPLICATIONS

This application is a Division of U.S. application Ser. No. 10/958,628,filed on Oct. 5, 2004, which is incorporated herein by reference.

TECHNICAL FIELD

The field generally relates to medical devices and, in particular, butnot by way of limitation, to systems and methods for managing functionsperformed by medical devices.

BACKGROUND

Patient care often includes use of advanced medical devices. Thesedevices typically automatically perform a host of functions includingtherapeutic functions, for example, to deliver therapy to a patient orpatients, or to perform diagnostic functions such as automaticallyrunning tests on patients. These functions are also sometimes referredto as features of the medical devices. Examples of medical devicesinclude, blood glucose meters, insulin pumps, urinalysis devices, fetalheart monitoring devices, blood test meters, sleep apnea or hypopneadetection devices, and sleep apnea therapy devices like continuouspositive airway pressure (CPAP) devices, blood pressure cuffs and weightscales. Implantable medical devices (IMDs) are devices designed to beimplanted into a patient. Some examples of IMDs include cardiac rhythmmanagement (CRM) devices such as implantable pacemakers and implantablecardioverter defibrillators (ICDs). The devices are used to treatpatients using electrical therapy and to aid a physician or caregiver inpatient diagnosis through internal monitoring of a patient's condition.IMDs may also include electrical leads that are either separate from, orconnected to, a CRM device. Electrical leads connected to CRM devicesare typically located in or near a heart to provide electrical therapyto the heart. The electrical leads are also in communication with senseamplifiers of the CRM devices to monitor intrinsic electrical heartactivity of a patient. Other examples of IMDs include implantableinsulin pumps or devices implanted to administer drugs to a patient.Additionally, some medical devices are able to communicate with otherdevices by wireless communication signals.

Often, the full functionality of the medical devices is not available oruseful to a patient or caregiver. The functions actually needed or usedmay be a subset of the available functions, such as to match the deviceto specific patient needs. If the medical device is implantable, adevice parameter, device configuration, or patient parameter may change.This, in turn, may require changing the functions available in themedical device.

Additionally, when new functions are developed, the functions may needto be approved by one or more governmental, quasi-governmental, or otherregulatory bodies, such as the Food and Drug Administration (FDA) of theUnited States Government. Gaining regulatory approval is often a longprocess. For example, it may involve lengthy clinical trials. If an IMDis marketed worldwide, an IMD manufacturer needs to gain approval forthe new functions from several regulatory bodies in differentgeographical areas of the world.

SUMMARY

The present inventors have recognized a need for improved management offunctions of medical devices. This document discusses, among otherthings, systems and methods provided for managing functions of medicaldevices. A method example includes a method of configuring a medicaldevice. The method comprises updating a regulatory approval statusstored in at least one of the medical device or a second device operableto communicate with the medical device, and enabling or disabling the atleast one function in the medical device based on the regulatoryapproval status. The regulatory approval status corresponds to at leastone function performable by the medical device.

A system example comprises an implantable medical device (IMD) and asecond device. The IMD includes a communication circuit, a memorycircuit and a controller circuit coupled to the at least one memorycircuit and communication circuit. The memory circuit of the IMD storesinstruction code executable by the controller circuit to perform atleast one function and to enable or disable the at least one function.The second device includes a communication circuit, a memory circuit anda controller circuit coupled to the at least one memory circuit and thecommunication circuit. The controller circuit of the second deviceexecutes instructions to communicate with the IMD. At least one of thememory circuits of the IMD and the second device stores a statusidentifier corresponding to a regulatory approval status of the at leastone function. The status identifier is used to enable or disable the atleast one function.

This summary is intended to provide an overview of the subject matter ofthe present patent application. It is not intended to provide anexclusive or exhaustive explanation of the invention. The detaileddescription is included to provide further information about the subjectmatter of the present patent application.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is an illustration of an embodiment of a system that uses animplantable medical device.

FIG. 2 is an illustration of an implantable medical device.

FIG. 3 is a block diagram of portions of an embodiment of a system thatmanages medical device functions.

FIG. 4 is a block diagram of portions of an embodiment of a system thatmanages medical device functions.

FIG. 5 is a block diagram of one example of a method of configuring amedical device.

FIG. 6 is a block diagram of a method of activating or deactivating afunction of a medical device.

DETAILED DESCRIPTION

In the following detailed description, reference is made to theaccompanying drawings which form a part hereof, and specific embodimentsin which the invention may be practiced are shown by way ofillustration. It is to be understood that other embodiments may be usedand structural or logical changes may be made without departing from thescope of the present invention. In this document, the term “or” is usedto refer to a nonexclusive or, unless otherwise indicated.

The present application discusses, among other things, systems andmethods for managing functions performed by medical devices. Medicaldevices are often complex and are typically capable of providing manydifferent functions. A patient may not require all of the functionalityof a particular device. However, the functionality required from thedevice may change, such as when information related to the patient orthe device is obtained. This information includes information related toa patient, such as a condition of the patient or change in condition ofthe patient. A change in the patient condition may result in a need fora different device having different functionality. If the device is animplantable device, the need for a different device typically results inanother implant procedure, which typically involves both increased costand risk.

This information related to the patient or the device may also includeinformation related to changes in device-measured parameters. Suchparameters may be measured after prompting by a user or doneautomatically by the device. Typically, the information is communicatedto a user by the medical device itself or by a second device used tocommunicate with the medical device. The information is typically givento a user through a user interface. The user may then change thefunctionality of the device using the user interface. There may beadverse delays in enabling or disabling the proper functions in amedical device. The “user” of a device refers to anyone who interactswith the device and includes without limitation a patient, a caregiverand a manufacturer of the device.

The information related to the patient or device may further includeinformation related to regulatory approval of the medical device. Whennew devices or device functions are developed, they typically need togain approval from one or more regulatory bodies such as the FDA. If themedical device is to be marketed worldwide, the new functions typicallyneed to be approved by several regulatory bodies. These regulatorybodies often have jurisdictions over different geographic areas. Theresult is that an approval status for a medical device (or, of certainfunctions of a medical device) may vary with geographic area. Thesegeographic jurisdictional areas may include multiple countries such asthe European Union (EU). Also, one country may base its regulatoryapproval on a regulatory approval of a body from another geographicjurisdiction, such as when regulatory approval in a non-EU countryfollows the approval of the EU. Additionally, a regulatory body may givelimited approval before full approval, such as approval for a researchstudy or approval for clinical trials. Also, a regulatory body may allowuse of a device, a function of a device, or both, for emergency usebefore the device or function receives full approval. Typically, devicemanufacturers deal with this problem by providing several models of amedical device with each model having a different set of unalterablefunctional capabilities, or by holding up distribution until the deviceshave gained approval. These approaches generate additional overheadcosts from the operation of multiple manufacturing lines, management ofadditional inventory and marketing of a multiple device product line.

In one example, these problems are avoided by providing completefunctionality in all model versions of a medical device and providing anupdated set of active functions based on the new information related tothe patient and/or device. This is accomplished by providing the abilityfor a medical device to dynamically configure a set of one or moreactive functions from a set of one or more performable functions whenthe device receives the information. These medical devices include acontroller circuit such as a microprocessor or microcontroller. Thecontroller circuit executes instruction code to perform the variousfunctions. According to some embodiments, all functionality resides inthe device and a section or sections of corresponding instruction codeare enabled to allow the medical device to provide the particularfunction. Conversely, these areas of instruction code are disabled toinhibit the function. For example, the enabling and disabling can berealized by branching to or around the pertinent areas of instructioncode. In some embodiments, the enabling and disabling includes applyingor removing power to circuitry that provides the functions, such astherapy circuitry for example. In some embodiments, the medical deviceis given an identifier after the update to reflect the newfunctionality, such as a new model number or dash or revision numberappended to or otherwise associated with the model number.

In other embodiments, new instruction code is loaded into the device toprovide a new function or set of functions. In some of theseembodiments, this instruction code can be loaded into volatile memoryfrom a second device, such as when a need for the updated code isrecognized by the medical device or the second device. In anotherembodiment, the medical device contains writeable non-volatile memorysuch as flash-memory, and the instruction code is loaded into theflash-memory. In this embodiment, the medical device includes a basickernel of instruction code to load and begin executing the downloadedinstruction code. In other embodiments, the controller circuit checksthe downloaded code for errors before loading the updated code intoflash memory. In one such embodiment, the updated instruction code isfirst loaded into volatile memory and checked for errors. In anotherembodiment, the instruction code is checked for errors as it is receivedfrom the second device. The medical device may also include a writecircuit that provides the voltages necessary to write non-volatilememory.

The medical device receiving the updated instruction code can be eitheran external device (such as an external cardioverter defibrillator, forexample) or an implantable medical device (IMD) (such as an implantablecardioverter defibrillator, for example). The second device sending theinstruction code can be an external device such as a computer, an IMDprogrammer, or a repeater, or the second device can be an externalmedical device or another IMD. The term “repeater” refers to a devicethat rebroadcasts information it receives. For example, a repeater mayreceive information by wired or wireless telephone or a wired orwireless connection to a communications network, such as the internet,and may rebroadcast the information using wireless communications, orvice versa. In this way, a repeater placed in proximity to a patient cancommunicate with an IMD thereby providing a user with a method toremotely communicate with an IMD.

FIG. 1 illustrates an embodiment of a system 100 that uses animplantable medical device (IMD) 110. The system 100 shown is oneembodiment of portions of a system used to treat a cardiac arrhythmia. Apulse generator (PG) or similar electronics unit or other IMD 110 iscoupled by an intravascular or other cardiac lead 108, or additionalleads, to a heart 105 of a patient 102. Examples of IMD 1 10 include,without limitation, a pacer, a defibrillator, a cardiacresynchronization therapy (CRT) device, or a combination of suchdevices. System 100 also includes an IMD programmer or other externaldevice 170 that typically provides wireless communication signals 160 tocommunicate with the IMD 110, such as inductive signals or radiofrequency (RF) signals. In some embodiments, the IMD 110 is able tocommunicate wirelessly with another IMD 110.

Cardiac lead 108 includes a proximal end that is coupled to IMD 110 anda distal end that includes an electrode or electrodes. The distal end iscoupled to, or placed in proximity to, one or more portions of a heart105. The electrodes are for delivering atrial or ventricularcardioversion/defibrillation or pacing or resynchronization therapy tothe heart 105. IMD 110 includes components that are enclosed in ahermetically-sealed canister or “can.” Additional electrodes may belocated on the can, or on an insulating header, or on other portions ofIMD 110, such as for providing unipolar pacing or defibrillation energy,for example, in conjunction with the electrodes disposed on or aroundheart 105. The lead 108 or leads and electrodes are also typically usedfor sensing intrinsic electrical activity of a heart 105 or for sensingimpedance associated with a heart or thorax.

FIG. 2 illustrates an IMD 110 coupled by one or more leads 108A-B toheart 105. Heart 105 includes a right atrium 200A, a left atrium 200B, aright ventricle 205A, a left ventricle 205B, and a coronary sinus 220extending from right atrium 200A. In this embodiment, atrial lead 108Aincludes electrodes (electrical contacts, such as ring electrode 225 andtip electrode 230) disposed in, around, or near an atrium 200A of heart105 for sensing signals and/or delivering pacing therapy to the atrium200A. Lead 108A optionally also includes additional electrodes, such asfor delivering atrial and/or ventricular cardioversion/defibrillationand/or pacing or resynchronization therapy to heart 105.

Ventricular lead 108B includes one or more electrodes, such as tipelectrode 235 and ring electrode 240, for delivering sensing signalsand/or delivering pacing therapy. Lead 108B optionally also includesadditional electrodes, such as for delivering atrial and/or ventricularcardioversion/defibrillation and/or pacing therapy to heart 105. IMD 110includes components that are enclosed in a hermetically-sealed canisteror “can” 250. Additional electrodes may be located on the can 250, or onan insulating header 255, or on other portions of IMD 110, for providingunipolar pacing and/or defibrillation energy in conjunction with theelectrodes disposed on or around heart 105. Other forms of electrodesinclude meshes and patches which may be applied to portions of heart 105or which may be implanted in other areas of the body to help “steer”electrical currents produced by IMD 110. In one embodiment, one ofatrial lead 108A or ventricular lead 108B is omitted, i.e., a “singlechamber” device is provided, rather than the dual chamber deviceillustrated in FIG. 2. In another embodiment, additional leads areprovided for coupling the IMD 110 to other heart chambers and/or otherlocations in the same heart chamber as one or more of leads 108A-B. Thepresent methods and systems will work in a variety of configurations andwith a variety of electrical contacts or “electrodes.” The methods andsystems also work in medical devices, implantable or external, that donot include leads or electrodes.

FIG. 3 is a block diagram 300 of portions of an embodiment of a system302 that manages medical device functions. The system 302 includes anIMD 305 and a second device 350. The IMD 305 includes at least onememory circuit 310, which is either separate from or integral to acontroller circuit 315 coupled to the at least one memory circuit 310.The memory circuit 315 stores instruction code 320 executable by thecontroller circuit 315 to perform at least one function. The IMD 305also includes a communication circuit 325 for communication with thesecond device 350. The second device 350 includes at least one memorycircuit 355, which is either separate from or integral to a controllercircuit 360 coupled to the at least one memory circuit 355, and acommunication circuit 365. A controller circuit 315, 360 operates usinghardware, firmware, software or any combination of hardware, firmwareand software.

The IMD 305 is dynamically configured after information is received thatis related to regulatory approval of a device function. The termfunction includes, among other things, any diagnostic test ormeasurement performed by a medical device (in this embodiment, an IMD305), any sensing function, any therapy delivered or performed by amedical device, or a medical device communicating using an approvedoperating frequency. In the example of FIG. 3, the IMD 305 includes atleast one cardiac signal sensing circuit 330 to detect cardiac signals,and the at least one function includes a diagnostic test. In anotherembodiment, the IMD 305 further includes a therapy circuit 335 coupledto the controller circuit 315, and the at least one function includes atherapy delivered to a patient.

At least one of the memory circuits 310, 355 of the IMD 305 and thesecond device 350 stores at least one status identifier 340, 370corresponding to a regulatory approval status of the at least onefunction. The status identifier 340, 370 is used to enable or disablethe at least one function. According to some embodiments of the system302, at least the memory circuit 310 of the IMD 305 stores the statusidentifier 340. In some examples, the second device 350 is operable tocommunicate at least one approved function to the IMD 305, and whereinthe IMD controller circuit 315 is operable to compare at least oneperformable function to the approved function and update at least onestatus identifier 340 in accordance with an outcome of a comparison. Inan example, the second device 350 may communicate a set of one or morefunctions to the IMD 305 that the IMD 305 is to perform. The IMDcontroller circuit 315 compares a set of active functions to the setobtained from the second device 350 and updates the corresponding IMDstatus identifier or identifiers 340 to match the set of activefunctions obtained from the second device. In another example, thesecond device sends one approved function at a time. The IMD 305 updatesthe corresponding IMD status identifiers 340 as the approved functionsare communicated. In this example, any non-communicated functions aredeemed to be disabled.

In other embodiments, at least the memory circuit 355 of the seconddevice 350 stores the status identifier 370. The second device 350communicates the status identifier 370 values for storage into the IMDmemory circuit 310 to enable or disable functions. According to yetother embodiments, the memory circuit 355 of the second device 350stores the status identifier 370, and the second device 350 enables ordisables the at least one function in the IMD 305 in accordance with theregulatory approval status. In another embodiment, the memory circuit310 of the IMD 305 stores the status identifier 340, and the IMD 305 isoperable to communicate an enabled or disabled status of the at leastone function to the second device 350.

To enable or disable the function, in certain examples, the IMDcontroller circuit 315 reads a first value in the status identifier 340that indicates that the corresponding function is not approved by theapplicable regulatory authority. Upon reading the first value, thecorresponding function is disabled and the controller circuit 315 doesnot perform that function. For example, reading the value may cause thecontroller circuit 315 to branch around the executable instruction codecorresponding to that function. When the controller circuit 315 reads asecond value in the status identifier 340 to indicate that thecorresponding function is approved by the applicable regulatory, thatfunction is enabled and the controller circuit 315 performs thatfunction.

In other examples, the second device controller circuit 360 reads afirst value or a second value in the status identifier 370 thatindicates that the corresponding function is not approved or approved bythe applicable regulatory authority. Upon reading the first or secondvalue, the second device 350 communicates a disable or enable to the IMD305 and the corresponding function is disabled or enabled by the IMD305. In further embodiments, a model number or a dash number of the IMD305 is changed, such as to reflect the corresponding updatedfunctionality.

In other embodiments, the system 302 further includes a geographiclocation identifier stored in at least one of the memory circuits 310,355 to identify the IMD 305 with a location. In one example, thelocation specifies where the device is deemed to be located (i.e. wherethe medical device is used or the patient resides). The location mayalternatively specify where the device 305 was implanted. In oneexample, the value of a status identifier 340, 370 enables or disablesthe corresponding function or functions in accordance with a regulatoryapproval status for the geographic location specified by thecorresponding stored geographic location identifier. In one example, thememory circuit 310, 355 includes a table or set of tables. The tableincludes locations where the function is approved. In another example, aset of tables includes geographic locations organized into tables byjurisdiction. Regulatory approval in a jurisdiction is reflected by anentire table of locations becoming approved. If the geographicidentifier is found in a table of approved locations, and the statusidentifier value is set to enable a function, then the controllercircuit enables that function. If the geographic identifier is not foundin a table of approved locations, and the status identifier value is setto enable the function, then the controller circuit does not enable thatfunction. As discussed previously, which controller circuit 315, 360enables or disables the function depends on where the status identifier340, 370 is stored.

In certain examples, at least one of the IMD 305 and the second device350 further includes a clock circuit coupled to the controller circuit315, 360. The controller circuit 315, 360 is operable to enable ordisable a function in relation to a time or date associated with aregulatory approval status. In one example, the controller circuit 315,360 updates a status identifier with a new value at least partially inresponse to a time or date read from the clock circuit. In anotherexample, the controller circuit 315, 360 performs a logic function (suchas an “and” function) of the status identifier with the clock circuitvalue to enable or disable the function. In this way, a medical devicecan be programmed, in anticipation of an approval date, to start using afunction after the anticipated approval date.

In another example, controller circuit 315, 360 uses a timing or clockcircuit to provide a slot of time when the function is enabled ordisabled. In the embodiment, the controller circuit 315, 360 enables ordisables a function on a start date or time and disables or enables thefunction after a timed duration. For example, the controller circuit315, 360 may update the status identifier with a new value during atimed duration, returning the status identifier to its previous valueafter the timed duration expires. In this way, a device may temporarilyenable a medical device, such as for use in a clinical study. In anotherembodiment, to use a medical device in a clinical study, the device isdeemed a clinical study device (such as by using a particular modelnumber or dash number, for example). In one such example, the statusidentifier 340, 370 includes a third value to indicate that the functionis approved for a clinical study purpose, and the third value enablesthe corresponding function in the clinical study device.

In another example, the status identifier 340, 370 includes a value toindicate that the function has an approved status during a patientemergency, and that value enables the corresponding function. In yetanother embodiment, the timing or clock circuit provides a time slotwhere a function is enabled or disabled during an emergency. In afurther embodiment, the emergency approved status is combined with thegeographical location identifier information to provide the emergencyfunction-enabled status in those geographic locations where suchemergency use has obtained regulatory approval.

In some examples, the at least one function includes an operatingfrequency for communication between the IMD 305 and the second device350. In one such example, the second device 350 communicates that acommunication frequency (or frequencies) between the IMD 305 and thesecond device 350 has approval (for example, in a particular geographiclocation) from the appropriate regulatory body (such as the FederalCommunications Commission (FCC), for example, in the United States). TheIMD 305 then begins communicating using the approved frequency orfrequencies.

In some examples, the second device 350 is another IMD. In one suchillustrative example, the first IMD 305 administers a drug and thesecond device 350 is a cardiac rhythm management device providingelectrical therapy.

In other examples, the second device 350 is an external device. In theexamples, the memory circuit 355 stores information about one or morefunctions performable by the IMD 305. Such information is stored alongwith one or more corresponding current status identifiers 370,geographical identifiers, or both. The current status identifiers 370indicate a most currently known regulatory approval status of thecorresponding function. In some examples, the memory circuit 355 alsoincludes at least one table including “device type” identifierscorresponding to any one or combinations of the performable functions.The term device type identifiers refers to any information thatidentifies the functionality of a device and includes model numbers,dash numbers, and the like. A particular device type identifier iscommunicated to a target device such as IMD 305 to reflect the newfunctionality of the device.

In one example, the second device 350 also includes a user interface forusers to interact with the second external device 350. In some examples,the memory circuit 355 of the external device stores regulatory approvalinformation. This includes regulatory approval by geographic location,or regulatory approval by jurisdiction. This information is used toupdate status identifiers in the IMD 305, for example, in accordancewith the geographic location or jurisdiction or to enable and disablefunctions according to the information. According to some examples, theinformation can be entered into the second device 350 using the userinterface. In some examples, the second device 350 receives theinformation from a third device. In another example, the second device350 receives the information from the IMD 305.

In some examples, the second device 350 communicates over a network. Inone such example, the second device 350 is an IMD programmer. In anotherexample, the second device 350 is a repeater that communicates with theIMD 305 and a third device which is remote from the external device. Inone example, such communication is carried out over a communicationnetwork. The communication network may be a wireless network such as acell phone network, a telephone land line network, a cable televisionnetwork, or a wired or wireless connection with a computer network, suchas the internet. Examples of the third device include a user's computeror computer network, a server, a hospital computer network, a devicemanufacturer's “Advanced Patient Management” system, or the like.

FIG. 4 shows a block diagram 400 of portions of a system 405 thatmanages medical device functions. In this example, both the medicaldevice and a second device are external devices. The system 400 includesa first external medical device 410 to perform diagnostic, therapeutic,or other functions. Examples of the first medical device 410 include,among other things, a blood glucose meter, an insulin pump, a urinalysisdevice, a fetal heart monitoring device, a blood test meter, a sleepapnea or hypopnea detection device, a sleep apnea therapy device, ablood pressure cuff, or a weight scale. The first external medicaldevice 410 includes at least one memory circuit 415 and a controllercircuit 420 coupled thereto. The memory circuit 415 stores instructioncode 430 executable by the controller circuit 420 to perform at leastone function. The memory circuit 415 also stores a corresponding statusidentifier 425 that enables or disables a corresponding functionaccording to a regulatory approval status of that function. The firstexternal device 410 also includes a communication circuit 435 coupled tothe controller circuit 420.

The system 405 also includes a second external device 450 thatcommunicates a regulatory approval status to the first device 410. Thesecond device 450 includes a communication circuit 455 to communicatewith the first device 410 and a memory circuit 460. The memory circuit460 stores information 465 about one or more functions performable bythe first device 410 along with one or more corresponding current statusidentifiers 470 of the most current regulatory approval status of acorresponding function. The second device 450 also includes a controllercircuit 475 coupled to the communication circuit 455 and the memorycircuit 460. The controller circuit 475 executes instructions tocommunicate the most current regulatory approval status to the firstdevice 410 via the communication circuit 455. The devices 410 and 450communicate via wireless or wired signals 490.

In some examples, the signals 490 are wireless communication signals,such as telemetry or radio frequency (RF) signals. In some examples, theat least one function includes communicating using a frequency ofoperation that is within a frequency spectrum approved by a regulatorybody that regulates communication frequencies. In an illustrativeexample, the function includes communicating using frequencies withinthe Industrial Scientific and Medical band (ISM) or within the ShortRange Devices (SRD) frequencies. In other examples, the signals 490 arecommunicated through a computer port such as a serial or parallel port.In further examples, the first and second devices 410 and 450 includeweb or other network interface circuits and the signals are communicatedusing the internet or other computer network.

In some examples, the controller circuits 420 or 475 executeinstructions to retrieve and store information between the memorycircuits 415 or 460 and the communication circuits 435 or 455. In otherexamples, the controller circuits 420 and 475 execute instructions toprovide a starting address and block size information to thecommunication circuits 435 or 455, and the communication circuits 435 or455 retrieve or store information from or to the memory circuits 415 or460.

The system 405 operates similarly to the system discussed previouslywhere the medical device is implantable. For example, the first medicaldevice 410 performs similar functions of the IMD. In some examples, thefirst medical device 410 further includes a geographic locationidentifier stored in the memory circuit 415 to identify where the firstdevice 410 is deemed to be located. A particular function'scorresponding status identifier enables or disables that function inaccordance with a geographic jurisdiction of a regulatory approvalagency. In some examples of the first device 410, to enable or disablethe function, the controller circuit 420 reads a first value in thestatus identifier 425 to indicate that the corresponding function is notapproved. Upon reading the first value, that function is disabled andthe controller circuit 420 does not perform that function. When thecontroller circuit 420 reads a second value in the status identifier 425to indicate that the corresponding function is approved, that functionis enabled and the controller circuit 420 performs that function. Inanother example, a third value of the status identifier 425 is used todesignate that the function is approved for a clinical study purpose andthe third value enables that function.

In some examples, the second device 450 communicates at least oneapproved function to the first device 410, and the controller circuit420 of the first device 410 compares a set of performable functions tothe approved function and updates any corresponding status identifiers425 to enable or disable functions based on the comparison. In otherexamples, the second device 450 communicates one more status identifiers425 or geographic identifiers associated with the regulatory approvalstatus to the first device 410 for storage. In other examples, only thememory circuit 460 of the second device 450 stores the identifier oridentifiers 470, and the second device 450 enables or disables the atleast one function in the first device 410 in accordance with theregulatory approval status. In other examples, the memory circuit 415 ofthe first device 410 stores the at least one status identifier 425, andthe first device 410 is operable to communicate an enabled or disabledstatus of the at least one function to the second device 450.

In some examples, at least one of the first and second devicescommunicates over a network with a third device or devices using eithercommunication circuits 435 and 455 or additional or other communicationcircuits. In some examples, the network includes a wirelesscommunication network. In further examples, the network includes theinternet, or another wired computer network. In one example, the seconddevice is a repeater in communication with a third device over theinternet either through hard wire or a wireless local area network(LAN). In another example, the first medical device 410 communicateswirelessly with another medical device such as an IMD.

FIG. 5 is a block diagram of one example of a method 500 of configuringa medical device. At 510, a regulatory approval status of at least onefunction performable by the medical device is updated. The status isstored in either the medical device, a second device operable tocommunicate with the medical device, or both devices. The medical devicemay be an external medical device or an implantable medical device(IMD). In one embodiment, the IMD is a cardiac rhythm management device.The second device may be an external device, an external medical device,or an IMD. At 520, the function is enabled or disabled in the medicaldevice based on the regulatory approval status. The at least onefunction includes, among other things, one or more diagnostic functions,one or more sensing functions, one or more therapeutic functions, orcommunicating using approved communication frequencies.

In some examples, the method 500 further includes comparing a geographicjurisdiction of a regulatory approval body to a geographic location ofthe medical device, and updating the regulatory approval status of thefunction using the comparison. In some examples, the geographic locationof the medical device includes a location where the medical device isdeemed to be located. In one example, such location is deemed to be thehome address of the patient or the location of a hospital or clinicfrequented by the patient. In certain examples in which the medicaldevice is an IMD, the geographic location is deemed to be a locationwhere the medical device was implanted into the patient. In yet otherexamples, the location is an actual location of the medical device, suchas determined by a global positioning system (GPS) or by communicationwith a particular node in a wireless or wired communication network thathas a known geographic location.

In some examples, enabling or disabling the at least one function of themedical device includes setting a corresponding status identifier to afirst value indicating that the function is not approved. This value isused to disable the device from performing that function. Enabling anddisabling also includes setting the status identifier to a second valueindicating that the function is approved. This value is used to enablethe device to perform that function. The term “used to enable ordisable” encompasses enabling and disabling in conjunction with otherenables or disables to provide further logical functions of the device.For example, a status identifier may enable a function because it hasregulatory approval and yet the function may remain disabled for anotherreason, such as because the function is not needed by the user. Thevalues are used by either the medical device or the second device toenable or disable the function.

According to some examples, updating a regulatory approval statusincludes updating a regulatory approval status stored in the seconddevice and communicating at least one identifier associated with theregulatory approval status to the medical device. The communicating maybe accomplished using wireless communication signals or thecommunicating may be over wired connections. In the examples, enablingor disabling the at least one function in accordance with the regulatoryapproval status includes enabling or disabling the function using themedical device. In one example, a controller circuit of the medicaldevice reads the value stored in its memory and branches around theexecutable instruction code corresponding to that function. When thecontroller circuit reads a second value in the status identifier toindicate that a corresponding function is approved by the applicableregulatory, that function is enabled and the controller circuit performsthat function.

In another example, the enabling or disabling is done using the seconddevice. The second device reads the identifier value stored in itsmemory and communicates with the medical device to enable or disable afunction, or functions, performable by the medical device. In anotherexample, the second device communicates at least one approved functionto the medical device. The medical device compares at least oneperformable function to the approved function. The comparison may bedone by using comparison circuitry, by executing instructions in acontroller circuit in the medical device to perform a comparison, orboth. Based on the comparison, the medical device then updates aregulatory approval status stored in the medical device.

In other examples, the regulatory approval is limited to using thedevice in a research study, or a clinical study. In some such limitedapproval cases, the enabling or disabling of the function in the medicaldevice includes enabling the function when the medical device is deemeda clinical-use device. In some examples, such limited approval isaccomplished by using a third value for a status identifier that enablesthe function when the medical device is identified as a clinical device,such as by communicating a clinical-use model or dash number to thedevice. In other examples, the function is enabled in relation to a dateof the study, such as enabling using a date and/or time. The enablingcan be done using the medical device or the second device. In otherexamples, the function is allotted a particular time window such that itis enabled only during the period of the clinical study. In one example,a function-enabled time window can be established using a timing orclock circuit in the medical device. The medical device updates a statusidentifier from one value to another during the time slot and returnsthe status identifier to the original value after the time slot. Inanother example, the timing or clock circuit is in the second device andthe second device updates the status identifiers to enable or disableone or more functions.

In some examples, the regulatory approval is limited to use of thefunction only during a patient emergency (such as while the functionawaits full regulatory approval). In these examples, the enabling anddisabling of status identifiers includes enabling the function during apatient emergency. Either the first device or the second device maydetect the emergency. In some of these examples, enabling the functionduring a patient emergency includes enabling the function for a timedduration and then disabling after the timed duration. As an illustrativeexample, suppose that the medical device is an implantable cardioverterdefibrillator (ICD) and the function includes a particulardefibrillation therapy. A regulatory body may allow use of the therapyonly during predetermined patient emergencies.

In some examples, the method 500 further includes validating the atleast one function having updated approval status. In some examples, thevalidating includes error-checking information that is associated withthe function and stored in the medical device. The information includesparameters used to perform a function stored in the medical device. Forexample, the parameter may be a value corresponding to an outputvoltage. The information checked can also include instruction codeexecuted to perform the function.

In some examples, the validating includes verifying that functions donot contain conflicting parameters. As an illustrative example, supposethat the medical device is a cardiac rhythm management device. In thisillustrative example, a status identifier update may enable a functionthat requires electrical leads that are not present in the system. Insome examples, the validating includes validating using the medicaldevice, the second device or a combination of the first and seconddevices. If the function cannot be validated because of parameter orother conflicts, in one example, the second device is not allowed tointeract with the medical device. This is useful, for example, wherethere is substantial interaction between parameters of multiplefunctions and it is not desirable to allow a user to have access to somebut not all parameters.

In some examples, the method 500 further includes providing notificationof an update of a set of active functions of the medical device. Thenotification is useful to a caregiver to be alerted to changes incapabilities of the medical devices. It is also useful to a manufacturerof devices to track the functionality of the devices. In some examples,providing notification includes providing notification of an update to athird device. For example, the third device may be a computer or serveron a network such as the internet, a hospital local area network (LAN),an APM, or the like. The notification can be sent by wireless or otherelectronic communication methods. In some examples, the update iscommunicated to a database. The database includes stored updates of theset of functions of devices which may be in the field or in inventory.In some examples, the notification includes notice that a device with acertain serial number has an updated different type identifier based onan updated set of functions active in the device. Examples of suchidentifiers include model numbers or dash or revision numbers appendedto or otherwise associated with a model number. Since either the firstor second device can be an IMD or an external device, providing thenotification can be carried out using an IMD or an external device.

According to some embodiments, the notification of the update isdelayed. In some examples of the embodiments, a notification is sent byelectronic mail (e-mail) and the notification is provided when thee-mail is opened. In other examples, the notification is delayed untilthe medical device is interrogated by either a user or another device.In other examples, the notification is provided through a user interfacedisplay on any of the mentioned devices, and notification is delayeduntil the next time a user interacts with the user interface

Some of the embodiments discussed previously involve status identifiersstored in two devices. This raises an issue of how to handle thedifferent circumstances that can arise when the identifiers agree,disagree, or when one, the other, or both of the identifiers aremissing. FIG. 6 is a block diagram of a method 600 of activating ordeactivating a function of a first medical device. At 610, regulatoryapproval information is stored in a second device that communicates withthe first device. In one example, the regulatory approval informationincludes regulatory approval by geographic location. Approval bygeographic location includes approval by country or region andcorresponds to geographic jurisdictions of regulating bodies. At 620,geographic location information associated with the first device isstored in the first device and geographic location informationassociated with the second device is stored in the second device. Thefirst medical device can be either an external medical device or an IMD.The second device can be an external device, an external medical device,or an IMD. In one example, the geographic location informationassociated with the first device includes a location where the device isdeemed to be located. If the first device is an IMD, the geographiclocation information includes a location where the device is implanted,in one example.

At 630, one or more approval status identifiers are used to enable ordisable at least one function of the first device. A first statusidentifier is stored in the first device to represent a first regulatoryapproval status of the function, and a second status identifier isstored in the second device to represent a second regulatory approvalstatus of the function. In some examples, values are assigned to thestatus identifiers, such as a first value to indicate an approved statusand a second value to indicate an unapproved status. Further examplesinclude assigning a third value to indicate a limited approval, such asto one or more clinical trials.

At 640, the first and second status identifiers are updated according toat least one rule. In one example, the at least one rule is applied tothe stored geographic information, the stored approval information, orthe status identifiers. In some examples, updating the statusidentifiers in the first and second devices according to at least onerule includes deeming the function approved. In further examples,deeming the function approved includes indicating the availability ofthe function using the second device. For example, if the second deviceis an external device with a user interface, in one example, a displayon the external device is used to indicate to the user that the functionis available. In other examples, deeming the function approved includesdeeming the function approved for clinical use.

In some examples, updating the first and second status identifiersaccording to the at least one rule includes deeming the functionunapproved. In the example where the second device is an external devicewith a user interface, a display on the external device is used toindicate to the user that the function is unavailable, such as by eithernot displaying the option or “ghosting” the option on the display. Infurther examples, deeming the function unapproved includes preventingaccess to the first device using the second device, such as by notallowing the communications or by limiting the communications. In yetanother example, deeming the function unapproved includes triggering analarm or notification using the second device.

In some examples, updating the first and second status identifiersaccording to a rule or a set of rules includes updating to affect themost restrictive use of a function or functions subject to approval. Forexample, if applying a rule or set of rules to the information andidentifiers results in one device allowing the function and a seconddevice not allowing the function, use of the function is not allowed. Insome examples, updating the first and second status identifiersaccording to a rule or a set of rules includes updating to affect theleast restrictive use of a function or functions subject to approval.For example, if applying a rule or set of rules to the information andidentifiers results in one device allowing the function and a seconddevice not allowing the function, use of the function is allowed.

Table 1 below illustrates one example of a set of rules applied tostored geographical information, stored approval information, or statusidentifiers. The result of applying the rules is to allow or not allowuse of one or more functions in a medical device. In the example shown,the first device is an IMD and the second device is an external device(PRM) to program the IMD. The PRM has a user interface including adisplay. The devices communicate using wireless signals. The embodimentis also applicable to two external devices or two IMDs. This exampleimplements a set of rules that is more restrictive. TABLE 1 FunctionRules PRM IMD Line IMD/PRM Function Function No. Geography Status StatusOutcome 1 Same Not approved Not approved Function not available. 2Different Not approved Not approved Function not available. IMD modelavailable with geography window. 3 Same Not approved Clinical Functionavailable OR not available depending on geography. If available, thenIMD model available with clinical window. 4 Different Not approvedClinical Function available OR not available depending on geography. Iffunction available, then IMD model available with geography window. 5Same Not approved Approved Out of sync - raise alarm. Function notavailable. 6 Different Not approved Approved Function available OR notavailable depending on geography. If function available, then IMD modelavailable with geography window. 7 Same Clinical Not approved Functionnot available (or available if IMD is deemed a clinical device). 8Different Clinical Not approved Function not available. IMD modelavailable with geography window. 9 Same Clinical Clinical Functionavailable. 10 Different Clinical Clinical Function available. IMD modelavailable with geography window. 11 Same Clinical Approved Out of sync -raise alarm. Function not available. 12 Different Clinical ApprovedFunction available OR not available depending on geography. If functionavailable, then IMD model available with geography window. 13 SameApproved Not approved Out of sync - raise alarm. Function not available.14 Different Approved Not approved Function not available. IMD modelavailable with geography window. 15 Same Approved Clinical Out of sync -raise alarm. Function not available. 16 Different Approved ClinicalFunction available. IMD model available with geography window. 17 SameApproved Approved Function available. 18 Different Approved ApprovedFunction available. IMD model available with geography window. 19 *Missing * Function not available. 20 * * Missing Function not available.21 PRM * * Special geography window Missing available. IMD model notavailable until geography is entered. 22 IMD * * IMD model notavailable. Missing

The first column of the table is merely the line number of the rules.The second column of the Table relates to the geographic locationinformation. Both the IMD and PRM contain geographic information. Thegeographic location information can be the same for the two devices,different for the two devices, or the information may be missing fromone or the other device. The third and fourth columns contain the statusidentifiers for the IMD and the PRM respectively. The status identifiercan be approved, not approved, approved for clinical study, or missing.The fifth column contains the outcome of applying the rules to thegeographic information and the status identifiers. The IMD model numberidentifies the type of IMD. Changes in a set of active functions in thedevice are tracked by modifying the model number with a dash number.

Line 1 of the Table shows an example of the simple case of the IMD andPRM containing the same geographic location information and the statusidentifiers of both devices agree that the function is not allowed inthe geographic location. The PRM is allowed to interact with the IMD butnot use the function. Line 2 of the Table shows an example of the casewhere the geographical information is different, but the function is notallowed in either location. The PRM is allowed to interact with thedevice and the user interface includes a window notifying the user ofthe geographic difference.

Lines 3 and 4 of the Table show a case where the IMD is a clinicaldevice but the PRM is not part of the clinical study. The function maybe allowed if the geographic location of the devices approves use of thefunction outside of a clinical study setting. In this case, a clinicalwindow is provided on the PRM user interface. If it is not approved, thefunction is not available. Because the geographic information of thedevices differs, a geographic window is provided on the PRM userinterface to notify the user of the geographic difference.

Lines 5 and 6 of the Table show examples of rules where the statusidentifiers conflict or are out of sync. Because the rules are morerestrictive, in this example, the function is not allowed in line 5. Inline 6 the function is allowed or not allowed depending on thegeographical location. Lines 7 through 12 are examples of rules based onthe PRM having a clinical status identifier for the function. Lines 13through 18 are examples of rules where the PRM has an approved status ofthe function. Lines 13 and 15 show examples of rules where an alarm orother notification is raised because the status identifiers do notmatch.

Lines 19 through 22 are examples of rules applied when some informationis missing. In lines 19 and 20, a status identifier is missing. In suchcases, use of the function is not allowed, in one example. Another wayto handle the case of missing identifiers is to not allow the PRM tointeract with the IMD. This approach is useful if the function hassubstantial interaction with other functions and the missing informationis important to know how to proceed. In line 21, the geographic locationinformation for the PRM is missing. Interaction with the IMD is notallowed until information is entered in the PRM. A special window isdisplayed for the user to enter geographical information. In line 22,the geographic location information for the IMD is missing. In this casethe PRM is not allowed to interact with the IMD. This case may arisewhen the IMD model is an old configuration or the PRM is not compatiblewith the IMD.

The Table is intended to show an example of a set of rules applied tostored geographical information, the stored approval information, andthe status identifiers. Other examples can be utilized to implementother logical results. For example, other examples implement a set ofleast restrictive rules. Additionally, a more restrictive implementationmay prevent more than just use of a function or set of functions. Forexample, most restrictive rules may prevent any interaction with the IMDin some circumstances. This is useful where there is substantialinteraction between parameters of multiple functions and it is notdesirable to allow a user to change some but not all parameters. Otherexamples of rules do not allow use of the function or functions if thegeographic information does not match.

The accompanying drawings that form a part hereof, show by way ofillustration, and not of limitation, specific embodiments in which thesubject matter may be practiced. The embodiments illustrated aredescribed in sufficient detail to enable those skilled in the art topractice the teachings disclosed herein. Other embodiments may beutilized and derived therefrom, such that structural and logicalsubstitutions and changes may be made without departing from the scopeof this disclosure. This Detailed Description, therefore, is not to betaken in a limiting sense, and the scope of various embodiments isdefined only by the appended claims, along with the full range ofequivalents to which such claims are entitled.

Such embodiments of the inventive subject matter may be referred toherein, individually and/or collectively, by the term “invention” merelyfor convenience and without intending to voluntarily limit the scope ofthis application to any single invention or inventive concept if morethan one is in fact disclosed. Thus, although specific embodiments havebeen illustrated and described herein, it should be appreciated that anyarrangement calculated to achieve the same purpose may be substitutedfor the specific embodiments shown. This disclosure is intended to coverany and all adaptations, or variations, or combinations of variousembodiments. Combinations of the above embodiments, and otherembodiments not specifically described herein, will be apparent to thoseof skill in the art upon reviewing the above description.

The Abstract of the Disclosure is provided to comply with 37 C.F.R. §1.72(b), requiring an abstract that will allow the reader to quicklyascertain the nature of the technical disclosure. It is submitted withthe understanding that it will not be used to interpret or limit thescope or meaning of the claims. In addition, in the foregoing DetailedDescription, it can be seen that various features are grouped togetherin a single embodiment for the purpose of streamlining the disclosure.This method of disclosure is not to be interpreted as reflecting anintention that the claimed embodiments require more features than areexpressly recited in each claim. Rather, as the following claimsreflect, inventive subject matter lies in less than all features of asingle disclosed embodiment. Thus the following claims are herebyincorporated into the Detailed Description, with each claim standing onits own as a separate embodiment.

1. A system comprising: an implantable medical device (IMD) including: acommunication circuit; a memory circuit; and a controller circuitcoupled to the at least one memory circuit and communication circuit,the memory circuit storing instruction code executable by the controllercircuit to perform at least one function and to enable or disable the atleast one function; and a second device including: a communicationcircuit; a memory circuit; and a controller circuit coupled to the atleast one memory circuit and the communication circuit, the controllercircuit executing instructions to communicate with the IMD; and whereinat least one of the memory circuits of the IMD and the second devicestores a geographical location identifier, and wherein at least one ofthe IMD and the second device is configured to automatically compare thegeographic location identifier to a geographic jurisdiction of aregulatory approval of the at least one function.
 2. The system of claim1, wherein at least one of the memory circuits of the IMD and the seconddevice stores a geographic location identifier to identify where the IMDwas implanted, and wherein the status identifier enables or disables thefunction in accordance with a regulatory approval status of the at leastone function, the approval status associated with the geographiclocation where the IMD was implanted.
 3. The system of claim 1, whereinat least one of the memory circuits of the IMD and the second devicestores a geographic location identifier stored in the memory circuit toidentify where the IMD is deemed to be located, and wherein the statusidentifier enables or disables the function in accordance with aregulatory approval status of the at least one function, the approvalstatus associated with the geographic location where the IMD is deemedto be located.
 4. The system of claim 1, in which the status identifierincludes a first value used to disable a function to indicate that thefunction is not approved, and a second value used to enable a functionto indicate that the function is approved.
 5. The system of claim 4, inwhich the status identifier includes a third value indicating that thefunction is approved for a clinical study purpose, and wherein the thirdvalue is used to enable the corresponding function.
 6. The system ofclaim 1, in which the status identifier includes a value to indicatethat the function has an approved status during a patient emergency, andwherein the value enables the corresponding function.
 7. The system ofclaim 6, wherein at least one of the memory circuits of the IMD and thesecond device stores a geographic location identifier, and wherein thestatus identifier enables or disables the function during an emergencyin accordance with a regulatory approval status of the function duringan emergency, wherein the regulatory approval status is associated withthe geographic location.
 8. The system of claim 1, wherein at least oneof the IMD and the second device further includes a timing circuitcoupled to its controller circuit, wherein the controller circuit isoperable to enable or disable a function during a timed durationassociated with a regulatory approval status.
 9. The system of claim 1,wherein at least one of the IMD and the second device further includes aclock circuit coupled to the controller circuit, wherein the controllercircuit is operable to enable or disable a function in relation to atime and/or date associated with a regulatory approval status.
 10. Thesystem of claim 1, wherein the IMD further includes at least one cardiacsignal sensing circuit operable to detect cardiac signals, and whereinthe at least one function includes a diagnostic test.
 11. The system ofclaim 1, wherein the IMD further includes a therapy circuit coupled tothe controller circuit, and wherein the at least one function includes atherapy delivered to a patient.
 12. The system of claim 1, wherein theat least one function includes a frequency of operation used incommunication between the IMD and the second device.
 13. The system ofclaim 1, wherein at least the memory circuit of the IMD stores thestatus identifier, wherein the second device is operable to communicateat least one approved function to the IMD, and wherein the IMDcontroller circuit is operable to compare at least one performablefunction to the approved function and update at least one statusidentifier in accordance with an outcome of a comparison.
 14. The systemof claim 1, wherein at least the memory circuit of the second devicestores the status identifier, and wherein the second device is operableto communicate at least one identifier associated with the regulatoryapproval status to the IMD.
 15. The system of claim 1, wherein thememory circuit of the second device stores the status identifier, andwherein the second device is operable to enable or disable the at leastone function in accordance with the regulatory approval status.
 16. Thesystem of claim 1, wherein the memory circuit of the IMD stores thestatus identifier, and wherein the IMD is operable to communicate anenabled or disabled status of the at least one function to the seconddevice.
 17. The system of claim 1, wherein the second device is anotherIMD.
 18. The system of claim 1, wherein the second device is an externaldevice further including a user interface.
 19. The system of claim 1,wherein the second device is operable to communicate over a network. 20.The system of claim 19, wherein the network includes a wirelesscommunication network.
 21. The system of claim 20, wherein the networkincludes the internet.